Gaming

13 Years Later, a Steam Server Leaked Two Rivals' Games

A Steam server Valve retired in 2013 sat publicly reachable for thirteen years. On August 29, 2026, archivists pulled 12 to 13 terabytes from it, including unreleased betas belonging to EA/BioWare and WB Games/Rocksteady, not just Valve's own files.

GamingBy Servola Tech Desk2026-09-014 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

13 Years Later, a Steam Server Leaked Two Rivals' Games

A Legacy Server Nobody Decommissioned

Valve left an old Steam content server publicly reachable for thirteen years after replacing it, and on August 29, 2026, archivists used that open access to pull roughly 12 to 13 terabytes of internal files out of it. No hacking was involved. Multiple outlets, including Game Developer and Tom's Hardware, confirmed the server carried no password or authentication of any kind - a leftover piece of "Steam2", the content-delivery system Valve retired in 2013 when it moved the store onto the SteamPipe infrastructure that still runs today.

The dump, quickly nicknamed the "Steam2 Teraleak", contains development builds, prototype assets and screenshots dated across the entire 2003-2013 span that server was in service. Valve had not issued a public statement by the time this was written, and outlets that contacted the company for comment reported no response.

The Files Are Not Only Valve's

The leak's most consequential contents belong to two other publishers, not Valve. Archivists and modders sifting the dump found unreleased beta builds from BioWare and EA's Dragon Age: Origins, and from Rocksteady and WB Games' Batman: Arkham Asylum, sitting alongside Valve's own unreleased material.

Valve's own haul includes early Portal 2 files that modders reconstructed into a playable 2009-era prototype, unused Left 4 Dead 2 and Counter-Strike: Global Offensive assets, and a handful of unused weapon models the community has linked to the long-cancelled Half-Life 2: Episode 3 - no playable build of that game has surfaced.

Studio / Publisher	Title	What Leaked
Valve	Portal 2	Reconstructed playable 2009 prototype build
Valve	Half-Life 2: Episode 3	Unused weapon models and assets, no playable build
BioWare / EA	Dragon Age: Origins	Unreleased beta build
Rocksteady / WB Games	Batman: Arkham Asylum	Unreleased beta build

A Breach With No Breach Law

Because no one hacked Valve, the leak sits outside the legal framework that would normally apply to a data breach. GDPR governs personal data - names, addresses, order records - and that is exactly what triggered Valve's own notification duty after the CEVA Logistics breach hit its European Steam hardware buyers in July and August 2026, forcing Valve to notify data-protection authorities in every affected country.

This leak is different. What was exposed here is corporate intellectual property - confidential, unreleased creative work belonging to two other companies - and IP exposed through platform negligence has no equivalent breach-notification regime anywhere in the EU. BioWare, EA, Rocksteady and WB Games have no statutory clock forcing Valve to tell them what leaked, when, or how it happened. Whatever remedy they pursue runs through contract or trade-secret law, case by case, not a regulator's fixed deadline.

What Any Studio Sharing Builds Should Ask

Every studio that ships a game through Steam hands Valve development files at some point, and this leak shows that retention can outlast the reason for it by over a decade. Before sharing a prototype build with any platform holder - Steam, but the same question applies to Epic, PlayStation and Xbox partner portals - ask for a written data-retention and decommissioning policy, not an assumption that old infrastructure gets deleted once a product moves to a new one.

The practical lesson is to treat unreleased build files with the same confidentiality-clause diligence as financial data, precisely because the legal remedy if they leak is weaker than what data-protection law provides for personal information. A locked cabinet at a trade show and a locked-down content server are the same problem in different clothes: the question is never whether something old still exists, it is who can still reach it.

Servola Journal

We do this for everyone trying to keep up with what technology is doing to our lives. The people who build it, and the people it happens to. The Servola Journal exists so that what we learn belongs to all of them.

Nobody pays us for this. No ads, no paywall, free to everyone. We just believe that understanding what's happening to all of us shouldn't depend on who can afford to pay for it.

If it gave you something today, tell us to keep going. Follow us, leave a like, or write a positive comment. We read every one, and they are what keeps us going.

Frequently asked questions

Was Valve hacked?

No. Every outlet that reported on the leak, including Game Developer and Tom's Hardware, confirmed the server had no password or authentication of any kind. It was a public, unsecured endpoint left running after Valve retired it in 2013, not an intrusion.

What exactly leaked?

Roughly 12 to 13 terabytes of internal development files dated 2003 to 2013, including a reconstructed Portal 2 prototype, unused Left 4 Dead 2 and Counter-Strike: Global Offensive assets, unused Half-Life 2: Episode 3 weapon models with no playable build, and unreleased betas of EA/BioWare's Dragon Age: Origins and WB Games/Rocksteady's Batman: Arkham Asylum.

Does GDPR cover this leak?

No. GDPR protects personal data such as names and order records, which is why Valve's earlier CEVA Logistics breach triggered mandatory regulator notification. This leak exposed corporate intellectual property instead, which falls outside GDPR's breach-notification framework entirely.

Valve replaced this server in 2013 and never turned off the address. Thirteen years is long enough that the question stopped being whether old infrastructure gets forgotten, and became what a rival's confidential files were doing on it the whole time.

ValveSteamData LeakEABioWareWB GamesGDPR

Texas's Solo Meta Strategy Just Topped $2 Billion

While 47 states spent three years reaching one settlement, Texas sued Meta alone twice and has now collected more than $2 billion, with no coalition to wait on.

5 min read

Consumer Tech

Second LED Patch, Same Unanswered CNIL Objection

Meta's second Ray-Ban Meta LED patch in two months closes another bypass, but France's CNIL already said in June the LED itself is not a valid consent fix.

5 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles